Plane CVE-2026-104976

Requires that an administrator has enabled Gitea OAuth in Plane and configured GITEA_HOST for a legitimate Gitea instance (feature is off by default). The attacker must possess a valid, low-privilege account on that specific Gitea instance (consistent with PR:L) in order to set an attacker-controlled external avatar_url in their Gitea profile and trigger the OAuth login flow. No victim user interaction is needed (the attacker drives their own login). Exploitation is LIMITED by: the non-default OAuth-enabled configuration, the need for a Gitea account trusted by the target, and the avatar handler's image-only Content-Type/size restrictions which constrain data return to a mostly blind SSRF primitive.

This is a genuine but conditional SSRF (CWE-918) rather than a drop-everything emergency. The input provides a CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) scoring 8.7, indicating network-reachable, low-complexity exploitation requiring low privileges and no user interaction. However, several signals temper real-world risk: there is no CISA KEV listing (no public evidence of active exploitation), no public exploit code identified in the provided references, and no EPSS probability was supplied to gauge likelihood. Crucially, exploitation is gated by two preconditions not reflected in the raw score - an administrator must have deliberately enabled Gitea OAuth against a legitimate Gitea instance, AND the attacker must hold a valid account on that Gitea instance (consistent with PR:L). I also assess the vendor's VC:H/VI:H impact as optimistic: the avatar code path only accepts image Content-Types and bounds size, so the primary primitive is a largely blind SSRF (internal reachability, port probing, hitting internal unauthenticated endpoints) rather than wholesale data exfiltration - verify impact assumptions against your internal network exposure. Net: treat as a real patch priority for any deployment that has enabled Gitea OAuth, lower priority otherwise.

An administrator enables Gitea OAuth in Plane pointing at a trusted Gitea server. An attacker who holds (or registers) a normal account on that Gitea instance sets their profile avatar URL to an internal target such as http://169.254.169.254/ or an internal admin endpoint, then logs into Plane via Gitea OAuth, causing Plane's backend to issue an outbound request to the attacker-chosen internal address without IP validation. No public exploit code was identified at time of analysis; the attack is derived from the vendor advisory and patch diff.